@m8t-stack/cli 0.2.35 → 0.2.36

package/README.md

@@ -121,12 +121,14 @@ Key flags: `--client-id <appId>` (reuse an existing app reg + skip **all** Micro
 
 ## Binding management — `m8t bind`
 
-Wire channel bots (Telegram, Slack, Teams) to Foundry workers. F4 ships
-the management API + CLI scaffolding; the actual adapters (which deliver
-inbound messages from each channel) ship in later features.
+Wire channel bots (Telegram, Slack, Teams) to Foundry workers. The binding
+management API + CLI cover all three channels; a channel can only complete
+a bind once its adapter (which delivers inbound messages from that
+channel) is registered at gateway startup — Telegram ships built in, Slack
+and Teams adapters are not registered yet.
 
 ```bash
-# Create a binding (requires the channel adapter — Telegram ships in F6)
+# Create a binding (Telegram's adapter ships built in)
 m8t bind add telegram \
   --worker cmo \
   --bot-token <from-botfather> \
@@ -152,17 +154,18 @@ m8t bind cleanup --all-orphaned
 
 > `--worker` is the **case-sensitive, lowercase** Foundry agent name as deployed (e.g. `cmo`). A wrong name isn't rejected at bind time — it surfaces later as an orphaned binding on the first message.
 
-### Pre-F6 behavior
+### Binding a channel with no registered adapter
 
-`m8t bind add telegram ...` currently fails with:
+`m8t bind add slack ...` (or `teams`) currently fails with:
 
 ```text
-error: no adapter for channel 'telegram'. This is expected for F4 alone;
-       the channel-specific adapter ships in a later feature.
+error: no adapter for channel 'slack'. The channel-specific adapter is not
+       registered in this build.
 ```
 
-This is correct. F6 (Telegram adapter) will register the adapter at
-startup and unlock the create flow.
+This is correct — Slack and Teams adapters aren't registered yet. Once a
+channel's adapter registers at gateway startup, binding creation for that
+channel unlocks.
 
 ### Cascade-delete idempotency
 

package/dist/cli.js

@@ -293,19 +293,9 @@ var init_secrets = __esm({
 });
 
 // ../../packages/github-app-auth/dist/esm/cache.js
-var cache_exports = {};
-__export(cache_exports, {
-  EXPIRY_SAFETY_MS: () => EXPIRY_SAFETY_MS,
-  _resetTokenCache: () => _resetTokenCache,
-  getCachedToken: () => getCachedToken,
-  putCachedToken: () => putCachedToken
-});
 function key(installationId, repository) {
   return `${installationId}:${repository}`;
 }
-function _resetTokenCache() {
-  cache2.clear();
-}
 function getCachedToken(installationId, repository) {
   const e = cache2.get(key(installationId, repository));
   if (!e)
@@ -384,17 +374,18 @@ var init_mint = __esm({
 });
 
 // ../../packages/github-app-auth/dist/esm/rotate.js
+function connectionStateKey(projectArmId, connectionName) {
+  return `${projectArmId}/connections/${connectionName}`;
+}
 async function rotateConnectionAuth(args) {
-  const { getCachedToken: getCachedToken2, putCachedToken: putCachedToken2 } = await Promise.resolve().then(() => (init_cache(), cache_exports));
-  const before = getCachedToken2(args.installationId, args.repository);
   const minted = await mintInstallationToken({
     credential: args.credential,
     kvUri: args.kvUri,
     installationId: args.installationId,
     repository: args.repository
   });
-  const cacheHit = before !== null && before.token === minted.token;
-  if (!cacheHit) {
+  const stateKey = connectionStateKey(args.projectArmId, args.connectionName);
+  if (connectionPatchState.get(stateKey) !== minted.token) {
     const armTokenResp = await args.credential.getToken(ARM_SCOPE);
     if (!armTokenResp?.token) {
       throw new Error("rotateConnectionAuth: failed to acquire ARM management token");
@@ -423,17 +414,18 @@ async function rotateConnectionAuth(args) {
       throw new Error(`rotateConnectionAuth: HTTP ${String(res.status)} on PATCH ${url}
 ${text.slice(0, 500)}`);
     }
-    putCachedToken2(args.installationId, args.repository, minted.token, minted.expiresAt);
+    connectionPatchState.set(stateKey, minted.token);
   }
   return { rotatedAt: /* @__PURE__ */ new Date(), expiresAt: minted.expiresAt };
 }
-var ARM_SCOPE, FOUNDRY_API;
+var ARM_SCOPE, FOUNDRY_API, connectionPatchState;
 var init_rotate = __esm({
   "../../packages/github-app-auth/dist/esm/rotate.js"() {
     "use strict";
     init_mint();
     ARM_SCOPE = "https://management.azure.com/.default";
     FOUNDRY_API = "2025-04-01-preview";
+    connectionPatchState = /* @__PURE__ */ new Map();
   }
 });
 
@@ -673,6 +665,53 @@ var init_foundry_agent_get = __esm({
   }
 });
 
+// src/lib/foundry-agent-version.ts
+async function createAgentVersion(args, fetchImpl = fetch) {
+  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE);
+  if (!token?.token) throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
+  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;
+  const res = await fetchImpl(url, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
+    body: JSON.stringify({ definition: args.definition, metadata: args.metadata })
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new LocalCliError({ code: "AGENT_CREATE_VERSION_FAILED", message: `POST ${url}: HTTP ${res.status.toString()}
+${text.slice(0, 500)}` });
+  }
+  await ensureAgentEndpointEntraIsolation(
+    { credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, extraHeaders: args.extraHeaders },
+    fetchImpl
+  );
+  const data = await res.json();
+  if (!data.version) throw new LocalCliError({ code: "AGENT_CREATE_VERSION_NO_VERSION", message: "createVersion returned no version" });
+  return data.version;
+}
+async function ensureAgentEndpointEntraIsolation(args, fetchImpl = fetch) {
+  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE);
+  if (!token?.token) throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
+  const url = `${args.projectEndpoint}/agents/${args.agentName}?api-version=v1`;
+  const res = await fetchImpl(url, {
+    method: "PATCH",
+    headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
+    body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new LocalCliError({ code: "AGENT_ENDPOINT_AUTH_PATCH_FAILED", message: `PATCH ${url}: HTTP ${res.status.toString()}
+${text.slice(0, 500)}` });
+  }
+}
+var FOUNDRY_DATA_SCOPE;
+var init_foundry_agent_version = __esm({
+  "src/lib/foundry-agent-version.ts"() {
+    "use strict";
+    init_errors();
+    FOUNDRY_DATA_SCOPE = "https://ai.azure.com/.default";
+  }
+});
+
 // src/lib/brain-yaml-mirror.ts
 import { parse as parseYaml4 } from "yaml";
 function linkSection(args) {
@@ -841,6 +880,12 @@ async function createCoderVersion(args) {
     foundryFeatures: "HostedAgents=V1Preview",
     metadata
   });
+  await ensureAgentEndpointEntraIsolation({
+    credential: args.credential,
+    projectEndpoint: args.endpoint,
+    agentName: args.name,
+    extraHeaders: { "Foundry-Features": "HostedAgents=V1Preview" }
+  });
   const v = version.version;
   if (v === void 0) {
     throw new LocalCliError({
@@ -905,6 +950,11 @@ async function createPromptVersion(args) {
   if (args.metadata.personaVersion !== null) metadata.personaVersion = args.metadata.personaVersion;
   if (args.metadata.fillableFieldValues !== void 0) metadata.fillableFieldValues = args.metadata.fillableFieldValues;
   const version = await project.agents.createVersion(args.name, definition, { metadata });
+  await ensureAgentEndpointEntraIsolation({
+    credential: args.credential,
+    projectEndpoint: args.endpoint,
+    agentName: args.name
+  });
   const v = version.version;
   if (v === void 0) {
     throw new LocalCliError({
@@ -931,6 +981,7 @@ var init_foundry_agents = __esm({
     "use strict";
     init_http();
     init_errors();
+    init_foundry_agent_version();
     METADATA_SOURCE = "m8t";
     FOUNDRY_SCOPE2 = "https://ai.azure.com/.default";
     API = "v1";
@@ -1247,7 +1298,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.35";
+var CLI_VERSION = "0.2.36";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1341,7 +1392,7 @@ var BACKEND_RULES = [
     reason: "no_adapter_registered",
     hint: (e) => {
       const channel = getDetailField(e, "channel") ?? "<channel>";
-      return `no adapter for channel '${channel}'. This is expected for F4 alone; the channel-specific adapter ships in a later feature.`;
+      return `no adapter for channel '${channel}'. The channel-specific adapter is not registered in this build.`;
     }
   },
   {
@@ -1453,6 +1504,14 @@ var LOCAL_RULES = {
   APP_HEALTH_FAILED: "Run `m8t brain check-app` for details, then re-run this command.",
   APP_UNINSTALL_FAILED: "GitHub App-uninstall DELETE failed. Re-run with `--keep-app-install` if you want to skip this step.",
   ARM_AUTH: "Run `az login` and retry.",
+  // BOOTSTRAP_OCCUPANCY_UNVERIFIED and BOOTSTRAP_REINSTALL_TARGET_MISMATCH are
+  // deliberately absent here: both are always thrown with an inline `hint`
+  // (see bootstrap-occupancy.ts / commands/bootstrap/launch.ts), and
+  // render-error.ts prefers that inline hint over this table — so a table
+  // entry for either code would be dead text that could drift from what
+  // actually prints. BOOTSTRAP_TARGET_OCCUPIED has no inline hint, so its
+  // entry below is the live one.
+  BOOTSTRAP_TARGET_OCCUPIED: "Pick an empty resource group with `--resource-group <new-rg>`, or run with both `--resource-group <rg>` and `--reinstall-into <rg>` (same group name) to install into the existing one anyway.",
   // m8t brain create: stageAsGitRepo step
   BRAIN_GIT_INIT_FAILED: "If git is not installed, install it. Otherwise re-run with --verbose.",
   BRAIN_NOT_LINKED: "The worker has no brain link. Use `m8t brain link` or `m8t brain create` first.",
@@ -11303,6 +11362,14 @@ function isUndiciDispatcherVersionMismatchError(error) {
   return false;
 }
 
+// ../../packages/foundry-invoke/dist/esm/openai-error.js
+function openAIErrorStatus(err) {
+  if (typeof err !== "object" || err === null)
+    return void 0;
+  const status = err.status;
+  return typeof status === "number" ? status : void 0;
+}
+
 // ../../packages/foundry-invoke/dist/esm/invoke-cli-core.js
 function isBrainConnPropagation(err) {
   const e = err;
@@ -11329,9 +11396,10 @@ function errText(err) {
   return `${e.code ?? ""} ${e.error?.code ?? ""} ${e.error?.message ?? ""} ${e.message ?? ""}`.trim();
 }
 function errStatus(err) {
+  const direct = openAIErrorStatus(err);
+  if (direct !== void 0)
+    return direct;
   const e = err;
-  if (typeof e.status === "number")
-    return e.status;
   if (typeof e.upstreamStatus === "number")
     return e.upstreamStatus;
   const m = /\b(4\d\d|5\d\d)\b/.exec(e.message ?? "");
@@ -11929,7 +11997,7 @@ var BindAddCommand = class extends M8tCommand {
   static paths = [["bind", "add"]];
   static usage = Command2.Usage({
     description: "Create a channel\u2192worker binding with bot token storage.",
-    details: "Stores the bot token in Key Vault and writes a Bindings table row. Returns the webhook URL the channel platform should call. F4-alone smoke fails with 'no_adapter_registered' until F6 (Telegram adapter) ships.",
+    details: "Stores the bot token in Key Vault and writes a Bindings table row. Returns the webhook URL the channel platform should call. Channels without a registered adapter (Slack, Teams) fail with 'no_adapter_registered'.",
     examples: [
       [
         "Add a Telegram binding for the cmo worker",
@@ -13898,49 +13966,7 @@ function hasA2aSnippet(instructions) {
 
 // src/lib/brain-link.ts
 init_foundry_agent_get();
-
-// src/lib/foundry-agent-version.ts
-init_errors();
-var FOUNDRY_DATA_SCOPE = "https://ai.azure.com/.default";
-async function createAgentVersion(args, fetchImpl = fetch) {
-  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE);
-  if (!token?.token) throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
-  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;
-  const res = await fetchImpl(url, {
-    method: "POST",
-    headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
-    body: JSON.stringify({ definition: args.definition, metadata: args.metadata })
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new LocalCliError({ code: "AGENT_CREATE_VERSION_FAILED", message: `POST ${url}: HTTP ${res.status.toString()}
-${text.slice(0, 500)}` });
-  }
-  const data = await res.json();
-  if (!data.version) throw new LocalCliError({ code: "AGENT_CREATE_VERSION_NO_VERSION", message: "createVersion returned no version" });
-  await ensureAgentEndpointEntraIsolation(
-    { credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, extraHeaders: args.extraHeaders },
-    fetchImpl
-  );
-  return data.version;
-}
-async function ensureAgentEndpointEntraIsolation(args, fetchImpl = fetch) {
-  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE);
-  if (!token?.token) throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
-  const url = `${args.projectEndpoint}/agents/${args.agentName}?api-version=v1`;
-  const res = await fetchImpl(url, {
-    method: "PATCH",
-    headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
-    body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new LocalCliError({ code: "AGENT_ENDPOINT_AUTH_PATCH_FAILED", message: `PATCH ${url}: HTTP ${res.status.toString()}
-${text.slice(0, 500)}` });
-  }
-}
-
-// src/lib/brain-link.ts
+init_foundry_agent_version();
 init_brain_yaml_mirror();
 var FOUNDRY_ARM_API = "2025-04-01-preview";
 var ARM_SCOPE4 = "https://management.azure.com/.default";
@@ -14131,7 +14157,7 @@ ${text.slice(0, 300)}`
       target: MCP_SERVER_URL,
       isSharedToAll: false,
       credentials: { keys: { Authorization: "Bearer placeholder-will-be-rotated" } },
-      metadata: { managedBy: "m8t-brain-f02" }
+      metadata: { managedBy: "m8t-brain-link" }
     }
   });
   const putRes = await fetch(url, {
@@ -14967,7 +14993,7 @@ var BrainLinkCommand = class extends M8tCommand {
   static paths = [["brain", "link"]];
   static usage = Command19.Usage({
     description: "Link a worker to an existing brain repo. Idempotent.",
-    details: "Installs the GitHub App on <repo> (browser click + poll), mints an installation token + PATCHes the Foundry connection, deploys a new agent version with the brain loader + tools[type:mcp] + metadata.brain JSON string, and pushes .m8t/brain.yaml to the repo. F1's PAT mode keeps working untouched. --force re-runs the full link cascade (loader re-render + createVersion + brain.yaml mirror) even when metadata.brain already matches \u2014 the F1 rescue path.",
+    details: "Installs the GitHub App on <repo> (browser click + poll), mints an installation token + PATCHes the Foundry connection, deploys a new agent version with the brain loader + tools[type:mcp] + metadata.brain JSON string, and pushes .m8t/brain.yaml to the repo. PAT mode keeps working untouched. --force re-runs the full link cascade (loader re-render + createVersion + brain.yaml mirror) even when metadata.brain already matches \u2014 useful to rescue a stuck or stale link.",
     examples: [
       ["Link cmo to orkeren21/cmo-brain", "$0 brain link cmo --repo orkeren21/cmo-brain"],
       ["Force a re-link (re-render brain loader + new agent version, even if already linked)", "$0 brain link cmo --repo orkeren21/cmo-brain --force"]
@@ -15242,6 +15268,7 @@ import * as fs12 from "fs";
 import * as os5 from "os";
 import * as path11 from "path";
 init_foundry_agent_get();
+init_foundry_agent_version();
 var FOUNDRY_ARM_API2 = "2025-04-01-preview";
 var ARM_SCOPE5 = "https://management.azure.com/.default";
 var GITHUB_APP_API = "https://api.github.com";
@@ -15687,6 +15714,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 // src/lib/a2a-enable.ts
 init_errors();
 init_foundry_agent_get();
+init_foundry_agent_version();
 import { randomBytes as randomBytes2, createHash } from "crypto";
 
 // src/lib/data-plane-ready.ts
@@ -18399,6 +18427,7 @@ async function runBicepDeployment(opts) {
 
 // src/lib/platform-converge.ts
 init_foundry_agent_get();
+init_foundry_agent_version();
 init_errors();
 
 // src/lib/persona-compose.ts
@@ -20049,7 +20078,7 @@ var PlatformConvergeCommand = class extends M8tCommand {
   static usage = Command33.Usage({
     category: "Platform",
     description: "Headless updater-job driver: claim a pending apply-request and converge the platform to it.",
-    details: "The Managed-Identity-authenticated entry point run by the updater Container Apps job. One invocation is one tick: it claims the pending apply-request row (if any), refuses a downgrade against the installed stamp, self-fetches and validates the target manifest, self-updates its own engine image when the manifest requires a newer CLI, then drives the F02 converge engine behind the T15 health-gate + auto-rollback. Reads its subscription/RG/endpoint/channel from env (MI_CLIENT_ID, SUBSCRIPTION_ID, RESOURCE_GROUP, FOUNDRY_ENDPOINT, M8T_UPDATE_CHANNEL_URL). Not intended for interactive use \u2014 the founder-facing path is 'm8t platform update'."
+    details: "The Managed-Identity-authenticated entry point run by the updater Container Apps job. One invocation is one tick: it claims the pending apply-request row (if any), refuses a downgrade against the installed stamp, self-fetches and validates the target manifest, self-updates its own engine image when the manifest requires a newer CLI, then drives the converge engine behind the health-gate + auto-rollback. Reads its subscription/RG/endpoint/channel from env (MI_CLIENT_ID, SUBSCRIPTION_ID, RESOURCE_GROUP, FOUNDRY_ENDPOINT, M8T_UPDATE_CHANNEL_URL). Not intended for interactive use \u2014 the founder-facing path is 'm8t platform update'."
   });
   async executeCommand() {
     const ctx = resolveHeadlessContextFromEnv(process.env);
@@ -21335,7 +21364,7 @@ function parseVerdict(stdout) {
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
   static usage = Command38.Usage({
-    description: "Vet one inbox skill candidate (Brain Faculties Eval F1): promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
+    description: "Vet one inbox skill candidate: promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
   candidate = Option35.String();
   skillsDir = Option35.String("--skills-dir");
@@ -21423,7 +21452,7 @@ function parseArmToken(tok, opts) {
     if (!opts.allowStub) {
       throw new LocalCliError({
         code: "USAGE",
-        message: `imported: arms are stub-only in F2 (a one-file placeholder) \u2014 pass --allow-stub to run one anyway, or use live/off/pinned for a real scored run (got '${tok}')`
+        message: `imported arms are stub-only (a one-file placeholder) \u2014 pass --allow-stub to run one anyway, or use live/off/pinned for a real scored run (got '${tok}')`
       });
     }
     return { state: { imported: ref }, profile };
@@ -21531,7 +21560,7 @@ function resolveJudgeDeployment(flag, env) {
   if (typeof fromEnv === "string" && fromEnv.length > 0) return { deployment: fromEnv };
   return {
     deployment: "gpt-5-mini",
-    warning: "no --deployment and no $EXAM_JUDGE_DEPLOYMENT \u2014 falling back to gpt-5-mini as the judge. Name the DISTINCT judge deployment before any blessing/calibration run (DESIGN \xA75.5)."
+    warning: "no --deployment and no $EXAM_JUDGE_DEPLOYMENT \u2014 falling back to gpt-5-mini as the judge. Name the DISTINCT judge deployment before any blessing/calibration run."
   };
 }
 var BRAIN_REPO_MARKERS = ["m8t-labs/", "/azure-advisor-brain", "/stacey-brain", "exam-arm-"];
@@ -21539,7 +21568,7 @@ function assertOutNotInBrainRepo(out) {
   if (BRAIN_REPO_MARKERS.some((m) => out.includes(m))) {
     throw new LocalCliError({
       code: "USAGE",
-      message: `--out '${out}' is under a brain repo \u2014 reports MUST live in the referee home (Law-1 guard, DESIGN \xA77.6)`
+      message: `--out '${out}' is under a brain repo \u2014 reports MUST live in the referee home (Law-1 guard)`
     });
   }
 }
@@ -21631,7 +21660,7 @@ function buildPlan(args) {
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
   static usage = Command39.Usage({
-    description: "Run a brain exam (Brain Referee E2-F2): impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
+    description: "Run a brain exam: impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
   worker = Option36.String();
   arms = Option36.String("--arms");
@@ -21704,7 +21733,7 @@ var EvalExamCommand = class extends M8tCommand {
       this.context.stdout.write(renderJson(plan) + "\n");
       this.context.stdout.write(
         `
-(dry-run) ~${String(arms.length)} arms x n=${String(reps)}; judge grading fan-out is the cost driver \u2014 confirm the run sits inside the ~150-550 judge-call band before driving workers (DESIGN \xA710).
+(dry-run) ~${String(arms.length)} arms x n=${String(reps)}; judge grading fan-out is the cost driver \u2014 confirm the run sits inside the ~150-550 judge-call band before driving workers.
 `
       );
       return 0;
@@ -24307,7 +24336,7 @@ function forcePolicyQuarantine(delta) {
     return {
       verb: "quarantine",
       slug: slugify(delta.title),
-      reason: "code-side standing-policy/auto-approval/privilege assertion (F16)",
+      reason: "code-side standing-policy/auto-approval/privilege assertion",
       body: delta.body,
       evidence: delta.evidence
     };
@@ -25680,6 +25709,17 @@ function ingestUrl(path38) {
 // src/commands/bootstrap/preflight.ts
 init_errors();
 
+// src/lib/spend-disclosure.ts
+var SPEND_DISCLOSURE = [
+  "You are about to install the m8t platform.",
+  "",
+  "  - It installs into YOUR Azure subscription and YOUR GitHub account or organization.",
+  "  - The Azure resources it creates bill to your Azure account - this uses your budget.",
+  "  - With your workers installed, you can ask Azzy what you're spending at any time,",
+  "    and you can turn on a cost report by email every two weeks.",
+  "  - You can remove it later - see guides/uninstall.md."
+].join("\n");
+
 // src/lib/bootstrap-preflight.ts
 var ADMIN_DIRECTORY_ROLES = ["Global Administrator", "Application Administrator", "Cloud Application Administrator"];
 async function checkSubScopeAdmin(callerObjectId, subscriptionId) {
@@ -25766,6 +25806,7 @@ var BootstrapPreflightCommand = class extends M8tCommand {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const oid = await getCallerObjectId();
+    this.context.stdout.write(SPEND_DISCLOSURE + "\n\n");
     this.context.stdout.write(buildPreflightBanner({ upn: account.upn, tenantId: account.tenantId, subscriptionId }) + "\n");
     this.context.stdout.write(`
 ${colors.dim(DISCLOSURE_TIER1)}
@@ -26076,10 +26117,95 @@ async function writeBootstrapState(state, home = os13.homedir()) {
   await fs29.rename(tmp, statePath(home));
 }
 
+// src/lib/bootstrap-occupancy.ts
+init_errors();
+var SAMPLE_LIMIT = 3;
+var M8T_NAME_RE = /^m8t/i;
+async function checkTargetRgOccupancy(opts) {
+  let existsRaw;
+  try {
+    existsRaw = await runAz([
+      "group",
+      "exists",
+      "--name",
+      opts.resourceGroup,
+      "--subscription",
+      opts.subscriptionId,
+      "-o",
+      "tsv"
+    ]);
+  } catch (cause) {
+    throw unverified(opts.resourceGroup, cause);
+  }
+  const exists2 = existsRaw.trim().toLowerCase();
+  if (exists2 === "false") return { state: "absent", found: [], total: 0, m8tShaped: false };
+  if (exists2 !== "true") {
+    throw unverified(opts.resourceGroup, new Error(`unexpected 'az group exists' output: ${exists2}`));
+  }
+  let names;
+  try {
+    const listRaw = await runAz([
+      "resource",
+      "list",
+      "--resource-group",
+      opts.resourceGroup,
+      "--subscription",
+      opts.subscriptionId,
+      "--query",
+      "[].name",
+      "-o",
+      "json"
+    ]);
+    names = JSON.parse(listRaw);
+  } catch (cause) {
+    throw unverified(opts.resourceGroup, cause);
+  }
+  if (!Array.isArray(names)) {
+    throw unverified(opts.resourceGroup, new Error("resource listing was not an array"));
+  }
+  if (names.length === 0) return { state: "empty", found: [], total: 0, m8tShaped: false };
+  return {
+    state: "occupied",
+    found: names.slice(0, SAMPLE_LIMIT),
+    total: names.length,
+    // Computed BEFORE the cap: an m8t-named resource sorting past the sample
+    // must still escalate the wording.
+    m8tShaped: names.some((n) => M8T_NAME_RE.test(n))
+  };
+}
+function unverified(resourceGroup, cause) {
+  return new LocalCliError({
+    code: "BOOTSTRAP_OCCUPANCY_UNVERIFIED",
+    message: `Could not verify whether resource group '${resourceGroup}' is empty.`,
+    hint: "Check your connection and 'az login', then retry.",
+    cause
+  });
+}
+function buildOccupiedRefusal(args) {
+  const { resourceGroup: rg, subscriptionId, location, occupancy: o } = args;
+  const hidden = o.total - o.found.length;
+  const more = hidden > 0 ? ` (+${String(hidden)} more)` : "";
+  const risk = o.m8tShaped ? "Installing into a non-empty resource group risks overwriting what's already there.\n  This looks like an existing m8t deployment; installing here would overwrite its identity." : "Installing into a non-empty resource group risks overwriting what's already there.";
+  return [
+    "",
+    "\u26D4 CANNOT PROCEED",
+    `  Resource group '${rg}' in subscription ${subscriptionId} is not empty \u2014 it holds`,
+    `  ${String(o.total)} resources, including: ${o.found.join(", ")}${more}.`,
+    `  ${risk}`,
+    "  remedy: pick an empty resource group \u2014",
+    `          m8t bootstrap launch --location ${location} --resource-group <new-rg>`,
+    "          or, if you really mean to install into this one:",
+    `          m8t bootstrap launch --location ${location} --resource-group ${rg} --reinstall-into ${rg}`,
+    "  Nothing has been created.",
+    "",
+    ""
+  ].join("\n");
+}
+
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.41";
+var DEFAULT_INSTALLER_TAG = "v0.1.42";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -26108,12 +26234,18 @@ var BootstrapLaunchCommand = class extends M8tCommand {
   githubAppCreds = Option47.String("--github-app-creds");
   contactEmail = Option47.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
   company = Option47.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  // Value-carrying on purpose: a bare --force would be cargo-culted into
+  // runbooks and harness prompts and erode the protection, whereas a faithful
+  // paste can never accidentally carry the victim group's name. It AUTHORIZES
+  // the target; --resource-group is what CHOOSES it.
+  reinstallInto = Option47.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
       throw new LocalCliError({ code: "USAGE", message: "--location is required.", hint: "Example: m8t bootstrap launch --location eastus2" });
     }
-    const resourceGroup = (typeof this.resourceGroup === "string" ? this.resourceGroup : void 0) ?? DEFAULT_RG;
+    const resourceGroupOpt = typeof this.resourceGroup === "string" ? this.resourceGroup : void 0;
+    const resourceGroup = resourceGroupOpt ?? DEFAULT_RG;
     const clientIdOpt = typeof this.clientId === "string" ? this.clientId : void 0;
     const installerTag = (typeof this.installerTag === "string" ? this.installerTag : void 0) ?? DEFAULT_INSTALLER_TAG;
     const installerImageOverride = typeof this.installerImage === "string" ? this.installerImage : void 0;
@@ -26123,6 +26255,28 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
     const out = (m) => this.context.stderr.write(`  ${colors.dim(m)}
 `);
+    const reinstallInto = typeof this.reinstallInto === "string" ? this.reinstallInto : void 0;
+    if (reinstallInto !== void 0 && reinstallInto.toLowerCase() !== resourceGroup.toLowerCase()) {
+      const targetExplanation = resourceGroupOpt === void 0 ? `you did not pass --resource-group, so the target is the default '${DEFAULT_RG}'` : `the target resource group is '${resourceGroup}'`;
+      throw new LocalCliError({
+        code: "BOOTSTRAP_REINSTALL_TARGET_MISMATCH",
+        message: `--reinstall-into '${reinstallInto}' does not match \u2014 ${targetExplanation}.`,
+        hint: `--reinstall-into authorizes the target; it does not choose it. Re-run with --resource-group ${reinstallInto} on its own first \u2014 the guard will show you what that group holds.`
+      });
+    }
+    const occupancy = await checkTargetRgOccupancy({ resourceGroup, subscriptionId });
+    if (occupancy.state === "occupied" && reinstallInto === void 0) {
+      this.context.stderr.write(buildOccupiedRefusal({ resourceGroup, subscriptionId, location, occupancy }));
+      throw new LocalCliError({
+        code: "BOOTSTRAP_TARGET_OCCUPIED",
+        message: `Resource group '${resourceGroup}' already holds ${String(occupancy.total)} resources.`
+      });
+    }
+    if (this.context.env.M8T_HALT_AFTER_OCCUPANCY === "1") {
+      this.context.stdout.write(`halt: occupancy check passed (${occupancy.state}) for ${resourceGroup}
+`);
+      return 0;
+    }
     const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path32.join(os14.homedir(), ".m8t", "github-app.json");
     let githubApp;
     if (fs30.existsSync(credsPath)) {